Please report security vulnerabilities privately — do not open a public issue or pull request for them.

Use GitHub's private reporting flow: Report a vulnerability.

Please include enough detail to reproduce the issue (affected version, a minimal repro or proof of concept, and the impact). You can expect an initial response within a few days. Once a fix is available it will be published as a new release.

Only the latest release receives security fixes.